Fix for bug #33389: Selecting from a view into a table from within SP

                    or trigger crashes server

Under some circumstances a combination of VIEWs, subselects with outer
references and PS/SP/triggers could lead to use of uninitialized memory
and server crash as a result.

Fixed by changing the code in Item_field::fix_fields() so that in cases
when the field is a VIEW reference, we first check whether the field
is also an outer reference, and mark it appropriately before returning.


mysql-test/r/view.result:
  Added a test case for bug #33389.
mysql-test/t/view.test:
  Added a test case for bug #33389.
sql/item.cc:
  In cases when in Item_field::fix_fields() from_field is a view reference,
  do not return too early, i.e. before marking the reference as an outer
  one when needed.

1 files changed, 22 insertions, 0 deletions

diff --git a/mysql-test/t/view.test b/mysql-test/t/view.test
index 340a34db5a1..b321f8604f7 100644
--- a/mysql-test/t/view.test
+++ b/mysql-test/t/view.test
@@ -3470,5 +3470,27 @@ insert into v1 values(1);
 set @@sql_mode=@old_mode;
 drop view v1;
 drop table t1;
+
+#
+# Bug #33389: Selecting from a view into a table from within SP or trigger 
+#             crashes server
+#
+
+create table t1 (a int, key(a));
+create table t2 (c int);
+                   
+create view v1 as select a b from t1;
+create view v2 as select 1 a from t2, v1 where c in 
+                  (select 1 from t1 where b = a);
+                   
+insert into t1 values (1), (1);
+insert into t2 values (1), (1);
+                   
+prepare stmt from "select * from v2 where a = 1";
+execute stmt; 
+
+drop view v1, v2;
+drop table t1, t2;
+
 --echo End of 5.0 tests.